Static task
static1
Behavioral task
behavioral1
Sample
3c71d8f58b1262bd8cae2670603e4cb7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3c71d8f58b1262bd8cae2670603e4cb7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c71d8f58b1262bd8cae2670603e4cb7_JaffaCakes118
-
Size
125KB
-
MD5
3c71d8f58b1262bd8cae2670603e4cb7
-
SHA1
eddd55a7260a545636e9ddfc3f5345c8dfab687c
-
SHA256
3d74327bce6ca5233965169a1b7504fc0eb70bd507a127abfb95146135ffa8c4
-
SHA512
6e4ba81371d493d7714698cdc0f66af503b9456eab076d9046a615a8b7ac3a08acbdf29f8c14694e5ac2c6e04abb7c5851428c47b63e2889a756f0ba408d7300
-
SSDEEP
3072:myD85nvl1bu7ZZDmVYz+oK/knALKZISQWTadV5/yQ+:FD8Vbu7ZpmCg/mIK7QWQyQ+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c71d8f58b1262bd8cae2670603e4cb7_JaffaCakes118
Files
-
3c71d8f58b1262bd8cae2670603e4cb7_JaffaCakes118.exe windows:4 windows x86 arch:x86
21453416523c0ecc9ef4c0373fb96e2f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
WriteFile
HeapFree
HeapAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
CreateProcessA
CreatePipe
TerminateProcess
PeekNamedPipe
SetEvent
CancelIo
LocalSize
Process32Next
Process32First
lstrcmpiA
GetCurrentThreadId
FindClose
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
HeapSize
IsBadWritePtr
HeapCreate
HeapDestroy
TlsGetValue
TlsAlloc
RaiseException
GetVersion
GetCommandLineA
GetStartupInfoA
GetDriveTypeA
CreateDirectoryA
InitializeCriticalSection
DeleteFileA
CreateMutexA
SetErrorMode
OpenEventA
ReleaseMutex
GetVersionExA
OutputDebugStringA
CreateEventA
ExitProcess
TerminateThread
OpenProcess
GetCurrentProcess
GetFileAttributesA
FreeLibrary
GetSystemDirectoryA
LocalFree
SetLastError
GetLastError
CreateFileA
SetFilePointer
ReadFile
lstrlenA
lstrcpyA
lstrcatA
GetTickCount
WaitForSingleObject
CloseHandle
Sleep
InterlockedExchange
LoadLibraryA
GetProcAddress
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
LCMapStringW
GetModuleHandleA
ExitThread
TlsSetValue
CreateThread
HeapReAlloc
RtlUnwind
user32
GetDC
CreateWindowExA
CloseWindow
SendMessageA
IsWindow
wsprintfA
MessageBoxA
PostQuitMessage
DefWindowProcA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
RegisterClassExA
LoadImageA
LoadCursorA
DestroyCursor
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
BlockInput
GetCursorInfo
ReleaseDC
GetDesktopWindow
GetCursorPos
SetRect
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
SystemParametersInfoA
gdi32
CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
SelectObject
GetStockObject
CreateDIBSection
advapi32
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
msvfw32
ICSeqCompressFrameEnd
ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ws2_32
closesocket
WSAStartup
gethostname
getsockname
connect
gethostbyname
htons
socket
send
select
ntohs
Sections
.text Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ